Warning: Permanently added '10.128.0.223' (ED25519) to the list of known hosts. 1970/01/01 00:00:46 ignoring optional flag "type"="gce" 1970/01/01 00:00:47 parsed 1 programs 1970/01/01 00:00:47 executed programs: 0 [ 47.202451][ T4263] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 47.274648][ T4274] chnl_net:caif_netlink_parms(): no params data found [ 47.294804][ T4274] bridge0: port 1(bridge_slave_0) entered blocking state [ 47.296017][ T4274] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.297507][ T4274] device bridge_slave_0 entered promiscuous mode [ 47.301795][ T4274] bridge0: port 2(bridge_slave_1) entered blocking state [ 47.303151][ T4274] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.304737][ T4274] device bridge_slave_1 entered promiscuous mode [ 47.320786][ T4274] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 47.323418][ T4274] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 47.333274][ T4274] team0: Port device team_slave_0 added [ 47.335383][ T4274] team0: Port device team_slave_1 added [ 47.352266][ T4274] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 47.353444][ T4274] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 47.357356][ T4274] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 47.359684][ T4274] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 47.360745][ T4274] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 47.364574][ T4274] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 47.419714][ T4274] device hsr_slave_0 entered promiscuous mode [ 47.468756][ T4274] device hsr_slave_1 entered promiscuous mode [ 48.001908][ T4274] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 48.029754][ T4274] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 48.069794][ T4274] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 48.100285][ T4274] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 48.157823][ T4274] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.159127][ T4274] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.160401][ T4274] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.161586][ T4274] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.188045][ T4274] 8021q: adding VLAN 0 to HW filter on device bond0 [ 48.195201][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 48.196922][ T136] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.198599][ T136] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.200560][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 48.205280][ T4274] 8021q: adding VLAN 0 to HW filter on device team0 [ 48.209672][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 48.211395][ T136] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.212544][ T136] bridge0: port 1(bridge_slave_0) entered forwarding state [ 48.216077][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 48.217637][ T136] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.218887][ T136] bridge0: port 2(bridge_slave_1) entered forwarding state [ 48.227152][ T230] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 48.229917][ T230] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 48.234365][ T230] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 48.237803][ T230] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 48.242661][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 48.245505][ T4274] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 48.298048][ T4274] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 48.300581][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 48.301853][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 48.309139][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 48.310994][ T136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 48.319963][ T1714] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 48.321656][ T1714] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 48.323836][ T1714] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 48.325287][ T1714] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 48.328183][ T4274] device veth0_vlan entered promiscuous mode [ 48.333878][ T4274] device veth1_vlan entered promiscuous mode [ 48.342830][ T1714] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 48.344562][ T1714] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 48.346108][ T1714] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 48.347752][ T1714] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 48.351391][ T4274] device veth0_macvtap entered promiscuous mode [ 48.353769][ T4274] device veth1_macvtap entered promiscuous mode [ 48.360367][ T4274] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 48.361608][ T1714] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 48.363234][ T1714] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 48.365021][ T1714] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 48.366883][ T1714] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 48.372213][ T4274] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 48.374790][ T4274] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.376178][ T4274] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.377438][ T4274] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.379671][ T4274] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 48.381779][ T1714] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 48.383325][ T1714] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 49.289419][ T4072] Bluetooth: hci0: command 0x0409 tx timeout [ 51.378988][ T4072] Bluetooth: hci0: command 0x041b tx timeout 1970/01/01 00:00:52 executed programs: 255 [ 53.448833][ T4072] Bluetooth: hci0: command 0x040f tx timeout [ 55.528696][ T4046] Bluetooth: hci0: command 0x0419 tx timeout 1970/01/01 00:00:57 executed programs: 681 1970/01/01 00:01:02 executed programs: 1103 [ 64.498446][ C1] IPv4: Attempt to release TCP socket in state 8 000000007b2f9a61 [ 64.500127][ C1] [ 64.500456][ C1] ========================= [ 64.501106][ C1] WARNING: held lock freed! [ 64.501754][ C1] syzkaller #0 Not tainted [ 64.502357][ C1] ------------------------- [ 64.502998][ C1] syz-executor.0/7212 is freeing memory ffff0000c1e44500-ffff0000c1e44fe7, with a lock still held there! [ 64.504618][ C1] ffff0000c1e44620 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_sendmsg+0x154/0x284 [ 64.505889][ C1] 2 locks held by syz-executor.0/7212: [ 64.506650][ C1] #0: ffff0000c1e44620 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_sendmsg+0x154/0x284 [ 64.508033][ C1] #1: ffff800008017b00 ((&msk->sk.icsk_retransmit_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd0/0x850 [ 64.509597][ C1] [ 64.509597][ C1] stack backtrace: [ 64.510441][ C1] CPU: 1 PID: 7212 Comm: syz-executor.0 Not tainted syzkaller #0 [ 64.511533][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 64.512933][ C1] Call trace: [ 64.513399][ C1] dump_backtrace+0x0/0x458 [ 64.514031][ C1] show_stack+0x2c/0x3c [ 64.514611][ C1] __dump_stack+0x30/0x40 [ 64.515211][ C1] dump_stack_lvl+0xf4/0x15c [ 64.515858][ C1] dump_stack+0x1c/0x5c [ 64.516432][ C1] debug_check_no_locks_freed+0x20c/0x29c [ 64.517265][ C1] slab_free_freelist_hook+0x88/0x1e4 [ 64.517980][ C1] kmem_cache_free+0xdc/0x3b0 [ 64.518655][ C1] __sk_destruct+0x42c/0x610 [ 64.519310][ C1] __sk_free+0x320/0x430 [ 64.519920][ C1] sk_free+0x68/0xd4 [ 64.520513][ C1] mptcp_retransmit_timer+0x190/0x29c [ 64.521332][ C1] call_timer_fn+0x19c/0x850 [ 64.521965][ C1] __run_timers+0xb34/0xd8c [ 64.522644][ C1] run_timer_softirq+0x7c/0x114 [ 64.523348][ C1] handle_softirqs+0x344/0xbe4 [ 64.524061][ C1] __irq_exit_rcu+0x240/0x43c [ 64.524739][ C1] irq_exit+0x14/0x88 [ 64.525309][ C1] handle_domain_irq+0x14c/0x1fc [ 64.526015][ C1] gic_handle_irq+0x78/0x1b8 [ 64.526700][ C1] call_on_irq_stack+0x30/0x48 [ 64.527396][ C1] do_interrupt_handler+0x6c/0x88 [ 64.528092][ C1] el1_interrupt+0x30/0x58 [ 64.528708][ C1] el1h_64_irq_handler+0x18/0x24 [ 64.529405][ C1] el1h_64_irq+0x78/0x7c [ 64.529997][ C1] _raw_spin_unlock_irqrestore+0xb8/0x14c [ 64.530798][ C1] __mod_timer+0xa98/0xb44 [ 64.531420][ C1] mod_timer+0x2c/0x3c [ 64.532047][ C1] sk_reset_timer+0x30/0xf4 [ 64.532667][ C1] __mptcp_push_pending+0x57c/0x694 [ 64.533378][ C1] mptcp_sendmsg+0x14a8/0x19b0 [ 64.534026][ C1] inet_sendmsg+0x154/0x284 [ 64.534680][ C1] ____sys_sendmsg+0x62c/0x940 [ 64.535369][ C1] ___sys_sendmsg+0x1f0/0x27c [ 64.536044][ C1] __arm64_sys_sendmsg+0x1bc/0x278 [ 64.536742][ C1] invoke_syscall+0x98/0x2b0 [ 64.537391][ C1] el0_svc_common+0x138/0x258 [ 64.538073][ C1] do_el0_svc+0x58/0x13c [ 64.538656][ C1] el0_svc+0x78/0x1d0 [ 64.539201][ C1] el0t_64_sync_handler+0xcc/0xe4 [ 64.539925][ C1] el0t_64_sync+0x1a0/0x1a4 [ 64.541191][ T7212] ------------[ cut here ]------------ [ 64.542067][ T7212] refcount_t: addition on 0; use-after-free. [ 64.543190][ T7212] WARNING: CPU: 1 PID: 7212 at lib/refcount.c:25 refcount_warn_saturate+0x134/0x1f8 [ 64.544661][ T7212] Modules linked in: [ 64.545251][ T7212] CPU: 1 PID: 7212 Comm: syz-executor.0 Not tainted syzkaller #0 [ 64.546437][ T7212] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 64.547902][ T7212] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 64.549086][ T7212] pc : refcount_warn_saturate+0x134/0x1f8 [ 64.549896][ T7212] lr : refcount_warn_saturate+0x134/0x1f8 [ 64.550794][ T7212] sp : ffff8000204b74b0 [ 64.551430][ T7212] x29: ffff8000204b74b0 x28: ffff0000d4f40180 x27: 0000000000000000 [ 64.552598][ T7212] x26: 00000000000000d0 x25: dfff800000000000 x24: ffff0000d4f40170 [ 64.553719][ T7212] x23: ffff0000c1e44d80 x22: 0000000000000000 x21: ffff0000c1e44bb8 [ 64.554845][ T7212] x20: ffff0000c1e44580 x19: ffff8000166d2000 x18: 0000000000000002 [ 64.556020][ T7212] x17: 0000000040000000 x16: ffff800011254fd8 x15: 0000000000000002 [ 64.557221][ T7212] x14: 0000000000000001 x13: 1fffe000341f60d7 x12: 0000000000ff0100 [ 64.558345][ T7212] x11: 0000000000000000 x10: 0000000000000000 x9 : 0694b28b53a08900 [ 64.559469][ T7212] x8 : 0694b28b53a08900 x7 : 0000000000000000 x6 : ffff800008247e40 [ 64.560630][ T7212] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80000a75d4cc [ 64.561737][ T7212] x2 : ffff0001a0fa4d50 x1 : 0000000100000000 x0 : 000000000000002a [ 64.562870][ T7212] Call trace: [ 64.563335][ T7212] refcount_warn_saturate+0x134/0x1f8 [ 64.564101][ T7212] sk_reset_timer+0xcc/0xf4 [ 64.564751][ T7212] __mptcp_push_pending+0x57c/0x694 [ 64.565475][ T7212] mptcp_sendmsg+0x14a8/0x19b0 [ 64.566136][ T7212] inet_sendmsg+0x154/0x284 [ 64.566789][ T7212] ____sys_sendmsg+0x62c/0x940 [ 64.567451][ T7212] ___sys_sendmsg+0x1f0/0x27c [ 64.568117][ T7212] __arm64_sys_sendmsg+0x1bc/0x278 [ 64.568834][ T7212] invoke_syscall+0x98/0x2b0 [ 64.569512][ T7212] el0_svc_common+0x138/0x258 [ 64.570173][ T7212] do_el0_svc+0x58/0x13c [ 64.570825][ T7212] el0_svc+0x78/0x1d0 [ 64.571405][ T7212] el0t_64_sync_handler+0xcc/0xe4 [ 64.572127][ T7212] el0t_64_sync+0x1a0/0x1a4 [ 64.572745][ T7212] irq event stamp: 1614 [ 64.573338][ T7212] hardirqs last enabled at (1614): [] kasan_quarantine_put+0xc4/0x200 [ 64.574745][ T7212] hardirqs last disabled at (1613): [] kasan_quarantine_put+0x108/0x200 [ 64.576102][ T7212] softirqs last enabled at (1576): [] mptcp_sendmsg+0xcd4/0x19b0 [ 64.577406][ T7212] softirqs last disabled at (1583): [] __irq_exit_rcu+0x240/0x43c [ 64.578635][ T7212] ---[ end trace e2225bb19106e3a8 ]--- [ 64.580417][ T7211] ------------[ cut here ]------------ [ 64.581359][ T7211] refcount_t: saturated; leaking memory. [ 64.582355][ T7211] WARNING: CPU: 0 PID: 7211 at lib/refcount.c:22 refcount_warn_saturate+0x1b4/0x1f8 [ 64.583749][ T7211] Modules linked in: [ 64.584303][ T7211] CPU: 0 PID: 7211 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 64.585647][ T7211] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 64.587109][ T7211] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 64.588330][ T7211] pc : refcount_warn_saturate+0x1b4/0x1f8 [ 64.589162][ T7211] lr : refcount_warn_saturate+0x1b4/0x1f8 [ 64.590036][ T7211] sp : ffff8000201679a0 [ 64.590657][ T7211] x29: ffff8000201679a0 x28: ffff0000e2946a48 x27: 1fffe00019b8c685 [ 64.591870][ T7211] x26: ffff0000c1e44500 x25: ffff80001420f000 x24: 1ffff00002841e30 [ 64.593087][ T7211] x23: ffff0000c1e44ed0 x22: 00000000c0000000 x21: ffff0000c1e44580 [ 64.594384][ T7211] x20: ffff0000c1e44580 x19: ffff8000166d2000 x18: 0000000000000001 [ 64.595608][ T7211] x17: 0000000000000000 x16: ffff800011254fd8 x15: 00000000ffffffff [ 64.596827][ T7211] x14: 0000000000000001 x13: 1fffe000341f07ab x12: 0000000000ff0100 [ 64.598029][ T7211] x11: 0000000000000000 x10: 0000000000000000 x9 : 2ee43e4cfc3eac00 [ 64.599241][ T7211] x8 : 2ee43e4cfc3eac00 x7 : 0000000000000001 x6 : 0000000000000001 [ 64.600456][ T7211] x5 : ffff8000201672b8 x4 : ffff80001436f3e0 x3 : ffff800008508fa8 [ 64.601668][ T7211] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000026 [ 64.602932][ T7211] Call trace: [ 64.603437][ T7211] refcount_warn_saturate+0x1b4/0x1f8 [ 64.604239][ T7211] mptcp_close+0x738/0x9e4 [ 64.604921][ T7211] inet_release+0x120/0x16c [ 64.605622][ T7211] sock_close+0xb4/0x1f8 [ 64.606298][ T7211] __fput+0x1c0/0x7e8 [ 64.606906][ T7211] ____fput+0x20/0x30 [ 64.607497][ T7211] task_work_run+0x12c/0x1d8 [ 64.608185][ T7211] do_notify_resume+0x2450/0x309c [ 64.608967][ T7211] el0_svc+0xf0/0x1d0 [ 64.609571][ T7211] el0t_64_sync_handler+0xcc/0xe4 [ 64.610346][ T7211] el0t_64_sync+0x1a0/0x1a4 [ 64.611071][ T7211] irq event stamp: 1890 [ 64.611657][ T7211] hardirqs last enabled at (1889): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 64.613200][ T7211] hardirqs last disabled at (1890): [] __schedule+0x2f0/0x1bc4 [ 64.614605][ T7211] softirqs last enabled at (1870): [] local_bh_enable+0x10/0x34 [ 64.615999][ T7211] softirqs last disabled at (1868): [] local_bh_disable+0x10/0x34 [ 64.617413][ T7211] ---[ end trace e2225bb19106e3a9 ]--- [ 64.618283][ T7211] ------------[ cut here ]------------ [ 64.619134][ T7211] ODEBUG: assert_init not available (active state 0) object type: timer_list hint: mptcp_retransmit_timer+0x0/0x29c [ 64.621017][ T7211] WARNING: CPU: 0 PID: 7211 at lib/debugobjects.c:521 debug_print_object+0x148/0x1d4 [ 64.622372][ T7211] Modules linked in: [ 64.622965][ T7211] CPU: 0 PID: 7211 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 64.624273][ T7211] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 64.625662][ T7211] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 64.626796][ T7211] pc : debug_print_object+0x148/0x1d4 [ 64.627585][ T7211] lr : debug_print_object+0x148/0x1d4 [ 64.628500][ T7211] sp : ffff800020167760 [ 64.629207][ T7211] x29: ffff800020167760 x28: dfff800000000000 x27: 0000000000000000 [ 64.630532][ T7211] x26: ffff800014290000 x25: ffff80000838172c x24: dfff800000000000 [ 64.631841][ T7211] x23: 0000000000000000 x22: ffff8000111424bc x21: ffff80001185eda0 [ 64.633160][ T7211] x20: ffff8000113c3160 x19: ffff80001185e8e0 x18: 0000000000000001 [ 64.634414][ T7211] x17: 0000000000000000 x16: ffff800011254fd8 x15: 00000000ffffffff [ 64.635616][ T7211] x14: 0000000000000001 x13: 1fffe000341f1ed7 x12: 0000000000ff0100 [ 64.636829][ T7211] x11: 0000000000000000 x10: 0000000000000000 x9 : 2ee43e4cfc3eac00 [ 64.638041][ T7211] x8 : 2ee43e4cfc3eac00 x7 : 0000000000000001 x6 : 0000000000000001 [ 64.639236][ T7211] x5 : ffff800020167078 x4 : ffff80001436f3e0 x3 : ffff80000a75d4cc [ 64.640446][ T7211] x2 : ffff0001a0f83d50 x1 : 0000000100000000 x0 : 0000000000000071 [ 64.641617][ T7211] Call trace: [ 64.642137][ T7211] debug_print_object+0x148/0x1d4 [ 64.642898][ T7211] debug_object_assert_init+0x24c/0x2c4 [ 64.643779][ T7211] __timer_delete+0x50/0x21c [ 64.644481][ T7211] timer_delete+0x24/0x34 [ 64.645120][ T7211] sk_stop_timer+0x24/0xcc [ 64.645829][ T7211] __mptcp_destroy_sock+0x288/0x610 [ 64.646653][ T7211] mptcp_close+0x5b8/0x9e4 [ 64.647359][ T7211] inet_release+0x120/0x16c [ 64.648029][ T7211] sock_close+0xb4/0x1f8 [ 64.648712][ T7211] __fput+0x1c0/0x7e8 [ 64.649287][ T7211] ____fput+0x20/0x30 [ 64.649890][ T7211] task_work_run+0x12c/0x1d8 [ 64.650586][ T7211] do_notify_resume+0x2450/0x309c [ 64.651348][ T7211] el0_svc+0xf0/0x1d0 [ 64.651944][ T7211] el0t_64_sync_handler+0xcc/0xe4 [ 64.652703][ T7211] el0t_64_sync+0x1a0/0x1a4 [ 64.653336][ T7211] irq event stamp: 1890 [ 64.653940][ T7211] hardirqs last enabled at (1889): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 64.655474][ T7211] hardirqs last disabled at (1890): [] __schedule+0x2f0/0x1bc4 [ 64.656804][ T7211] softirqs last enabled at (1870): [] local_bh_enable+0x10/0x34 [ 64.658149][ T7211] softirqs last disabled at (1868): [] local_bh_disable+0x10/0x34 [ 64.659546][ T7211] ---[ end trace e2225bb19106e3aa ]--- [ 64.660420][ T7211] ------------[ cut here ]------------ [ 64.661228][ T7211] ODEBUG: assert_init not available (active state 0) object type: timer_list hint: mptcp_tout_timer+0x0/0xe0 [ 64.663087][ T7211] WARNING: CPU: 0 PID: 7211 at lib/debugobjects.c:521 debug_print_object+0x148/0x1d4 [ 64.664432][ T7211] Modules linked in: [ 64.664972][ T7211] CPU: 0 PID: 7211 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 64.666298][ T7211] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 64.667738][ T7211] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 64.668867][ T7211] pc : debug_print_object+0x148/0x1d4 [ 64.669657][ T7211] lr : debug_print_object+0x148/0x1d4 [ 64.670510][ T7211] sp : ffff800020167760 [ 64.671099][ T7211] x29: ffff800020167760 x28: dfff800000000000 x27: 0000000000000001 [ 64.672242][ T7211] x26: ffff800014290000 x25: ffff80000838172c x24: dfff800000000000 [ 64.673387][ T7211] x23: 0000000000000000 x22: ffff800011142758 x21: ffff80001185eda0 [ 64.674573][ T7211] x20: ffff8000113c3160 x19: ffff80001185e8e0 x18: 0000000000000001 [ 64.675726][ T7211] x17: 0000000000000000 x16: ffff800011254fd8 x15: 00000000ffffffff [ 64.676852][ T7211] x14: 0000000000000001 x13: 1fffe000341f1ed7 x12: 0000000000ff0100 [ 64.678100][ T7211] x11: 0000000000000000 x10: 0000000000000000 x9 : 2ee43e4cfc3eac00 [ 64.679259][ T7211] x8 : 2ee43e4cfc3eac00 x7 : 0000000000000001 x6 : 0000000000000001 [ 64.680422][ T7211] x5 : ffff800020167078 x4 : ffff80001436f3e0 x3 : ffff80000a75d4cc [ 64.681546][ T7211] x2 : ffff0001a0f83d50 x1 : 0000000100000000 x0 : 000000000000006a [ 64.682744][ T7211] Call trace: [ 64.683242][ T7211] debug_print_object+0x148/0x1d4 [ 64.684018][ T7211] debug_object_assert_init+0x24c/0x2c4 [ 64.684883][ T7211] __timer_delete+0x50/0x21c [ 64.685572][ T7211] timer_delete+0x24/0x34 [ 64.686239][ T7211] sk_stop_timer+0x24/0xcc [ 64.686918][ T7211] __mptcp_destroy_sock+0x294/0x610 [ 64.687759][ T7211] mptcp_close+0x5b8/0x9e4 [ 64.688475][ T7211] inet_release+0x120/0x16c [ 64.689171][ T7211] sock_close+0xb4/0x1f8 [ 64.689748][ T7211] __fput+0x1c0/0x7e8 [ 64.690313][ T7211] ____fput+0x20/0x30 [ 64.690883][ T7211] task_work_run+0x12c/0x1d8 [ 64.691529][ T7211] do_notify_resume+0x2450/0x309c [ 64.692269][ T7211] el0_svc+0xf0/0x1d0 [ 64.692895][ T7211] el0t_64_sync_handler+0xcc/0xe4 [ 64.693640][ T7211] el0t_64_sync+0x1a0/0x1a4 [ 64.694314][ T7211] irq event stamp: 1890 [ 64.694902][ T7211] hardirqs last enabled at (1889): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 64.696538][ T7211] hardirqs last disabled at (1890): [] __schedule+0x2f0/0x1bc4 [ 64.697833][ T7211] softirqs last enabled at (1870): [] local_bh_enable+0x10/0x34 [ 64.699168][ T7211] softirqs last disabled at (1868): [] local_bh_disable+0x10/0x34 [ 64.700571][ T7211] ---[ end trace e2225bb19106e3ab ]--- [ 64.701483][ T7211] ------------[ cut here ]------------ [ 64.702273][ T7211] refcount_t: underflow; use-after-free. [ 64.703257][ T7211] WARNING: CPU: 0 PID: 7211 at lib/refcount.c:28 refcount_warn_saturate+0x154/0x1f8 [ 64.704599][ T7211] Modules linked in: [ 64.705238][ T7211] CPU: 0 PID: 7211 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 64.706620][ T7211] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 64.708133][ T7211] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 64.709298][ T7211] pc : refcount_warn_saturate+0x154/0x1f8 [ 64.710160][ T7211] lr : refcount_warn_saturate+0x154/0x1f8 [ 64.711073][ T7211] sp : ffff8000201678c0 [ 64.711689][ T7211] x29: ffff8000201678c0 x28: dfff800000000000 x27: ffff70000402cf20 [ 64.712896][ T7211] x26: ffff0000c1e44500 x25: 1fffe000183c89da x24: ffff0000c1e44ed0 [ 64.714109][ T7211] x23: ffff0000c1e44ef8 x22: 0000000000000000 x21: 00000000c0000000 [ 64.715316][ T7211] x20: ffff0000c1e44580 x19: ffff8000166d2000 x18: 0000000000000001 [ 64.716476][ T7211] x17: 0000000000000000 x16: ffff800011254fd8 x15: 00000000ffffffff [ 64.717703][ T7211] x14: 0000000000000001 x13: 1fffe000341f1ed7 x12: 0000000000ff0100 [ 64.718998][ T7211] x11: 0000000000000000 x10: 0000000000000000 x9 : 2ee43e4cfc3eac00 [ 64.720206][ T7211] x8 : 2ee43e4cfc3eac00 x7 : 0000000000000001 x6 : 0000000000000001 [ 64.721429][ T7211] x5 : ffff8000201671d8 x4 : ffff80001436f3e0 x3 : ffff80000a75d4cc [ 64.722606][ T7211] x2 : ffff0001a0f83d50 x1 : 0000000100000000 x0 : 0000000000000026 [ 64.723856][ T7211] Call trace: [ 64.724391][ T7211] refcount_warn_saturate+0x154/0x1f8 [ 64.725199][ T7211] __mptcp_destroy_sock+0x570/0x610 [ 64.725980][ T7211] mptcp_close+0x5b8/0x9e4 [ 64.726631][ T7211] inet_release+0x120/0x16c [ 64.727331][ T7211] sock_close+0xb4/0x1f8 [ 64.727966][ T7211] __fput+0x1c0/0x7e8 [ 64.728580][ T7211] ____fput+0x20/0x30 [ 64.729173][ T7211] task_work_run+0x12c/0x1d8 [ 64.729835][ T7211] do_notify_resume+0x2450/0x309c [ 64.730561][ T7211] el0_svc+0xf0/0x1d0 [ 64.731160][ T7211] el0t_64_sync_handler+0xcc/0xe4 [ 64.731935][ T7211] el0t_64_sync+0x1a0/0x1a4 [ 64.732576][ T7211] irq event stamp: 1890 [ 64.733173][ T7211] hardirqs last enabled at (1889): [] _raw_spin_unlock_irqrestore+0xa8/0x14c [ 64.734685][ T7211] hardirqs last disabled at (1890): [] __schedule+0x2f0/0x1bc4 [ 64.736085][ T7211] softirqs last enabled at (1870): [] local_bh_enable+0x10/0x34 [ 64.737532][ T7211] softirqs last disabled at (1868): [] local_bh_disable+0x10/0x34 [ 64.738971][ T7211] ---[ end trace e2225bb19106e3ac ]--- 1970/01/01 00:01:07 executed programs: 1568 [ 69.608631][ T21] cfg80211: failed to load regulatory.db [ 69.609874][ T2065] ieee802154 phy0 wpan0: encryption failed: -22 [ 69.610862][ T2065] ieee802154 phy1 wpan1: encryption failed: -22 1970/01/01 00:01:12 executed programs: 2103 [ 73.958338][ C1] IPv4: Attempt to release TCP socket in state 8 00000000815f0594 [ 73.961339][ T9198] ------------[ cut here ]------------ [ 73.962219][ T9198] ODEBUG: assert_init not available (active state 0) object type: timer_list hint: mptcp_retransmit_timer+0x0/0x29c [ 73.964143][ T9198] WARNING: CPU: 1 PID: 9198 at lib/debugobjects.c:521 debug_print_object+0x148/0x1d4 [ 73.965615][ T9198] Modules linked in: [ 73.966152][ T9198] CPU: 1 PID: 9198 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 73.967474][ T9198] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 73.968980][ T9198] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 73.970178][ T9198] pc : debug_print_object+0x148/0x1d4 [ 73.970998][ T9198] lr : debug_print_object+0x148/0x1d4 [ 73.971777][ T9198] sp : ffff80001fe27760 [ 73.972413][ T9198] x29: ffff80001fe27760 x28: dfff800000000000 x27: 0000000000000000 [ 73.973652][ T9198] x26: ffff800014290000 x25: ffff80000838172c x24: dfff800000000000 [ 73.974816][ T9198] x23: 0000000000000000 x22: ffff8000111424bc x21: ffff80001185eda0 [ 73.976040][ T9198] x20: ffff8000113c3160 x19: ffff80001185e8e0 x18: 0000000000000001 [ 73.977243][ T9198] x17: 0000000000000000 x16: ffff800011254fd8 x15: 00000000ffffffff [ 73.978384][ T9198] x14: 0000000000000001 x13: 1fffe000341f49ab x12: 0000000000ff0100 [ 73.979548][ T9198] x11: 0000000000000000 x10: 0000000000000000 x9 : b9d0e8e75d457300 [ 73.980693][ T9198] x8 : b9d0e8e75d457300 x7 : 0000000000000001 x6 : 0000000000000001 [ 73.981890][ T9198] x5 : ffff80001fe27078 x4 : ffff80001436f3e0 x3 : ffff800008508fa8 [ 73.983018][ T9198] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000071 [ 73.984122][ T9198] Call trace: [ 73.984570][ T9198] debug_print_object+0x148/0x1d4 [ 73.985277][ T9198] debug_object_assert_init+0x24c/0x2c4 [ 73.986092][ T9198] __timer_delete+0x50/0x21c [ 73.986767][ T9198] timer_delete+0x24/0x34 [ 73.987357][ T9198] sk_stop_timer+0x24/0xcc [ 73.988021][ T9198] __mptcp_destroy_sock+0x288/0x610 [ 73.988840][ T9198] mptcp_close+0x5b8/0x9e4 [ 73.989503][ T9198] inet_release+0x120/0x16c [ 73.990165][ T9198] sock_close+0xb4/0x1f8 [ 73.990773][ T9198] __fput+0x1c0/0x7e8 [ 73.991350][ T9198] ____fput+0x20/0x30 [ 73.991969][ T9198] task_work_run+0x12c/0x1d8 [ 73.992646][ T9198] do_notify_resume+0x2450/0x309c [ 73.993371][ T9198] el0_svc+0xf0/0x1d0 [ 73.993962][ T9198] el0t_64_sync_handler+0xcc/0xe4 [ 73.994698][ T9198] el0t_64_sync+0x1a0/0x1a4 [ 73.995380][ T9198] irq event stamp: 0 [ 73.995962][ T9198] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 73.996983][ T9198] hardirqs last disabled at (0): [] copy_process+0x1110/0x34c8 [ 73.998274][ T9198] softirqs last enabled at (0): [] copy_process+0x1140/0x34c8 [ 73.999633][ T9198] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 74.000627][ T9198] ---[ end trace e2225bb19106e3ad ]--- [ 74.002654][ T9198] ------------[ cut here ]------------ [ 74.003613][ T9198] ODEBUG: assert_init not available (active state 0) object type: timer_list hint: mptcp_tout_timer+0x0/0xe0 [ 74.005587][ T9198] WARNING: CPU: 0 PID: 9198 at lib/debugobjects.c:521 debug_print_object+0x148/0x1d4 [ 74.007011][ T9198] Modules linked in: [ 74.007616][ T9198] CPU: 0 PID: 9198 Comm: syz-executor.0 Tainted: G W syzkaller #0 [ 74.009027][ T9198] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 74.010480][ T9198] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 74.011613][ T9198] pc : debug_print_object+0x148/0x1d4 [ 74.012393][ T9198] lr : debug_print_object+0x148/0x1d4 [ 74.013182][ T9198] sp : ffff80001fe27760 [ 74.013779][ T9198] x29: ffff80001fe27760 x28: dfff800000000000 x27: 0000000000000001 [ 74.014937][ T9198] x26: ffff800014290000 x25: ffff80000838172c x24: dfff800000000000 [ 74.016124][ T9198] x23: 0000000000000000 x22: ffff800011142758 x21: ffff80001185eda0 [ 74.017544][ T9198] x20: ffff8000113c3160 x19: ffff80001185e8e0 x18: 0000000000000002 [ 74.018957][ T9198] x17: 0000000040000000 x16: ffff800011254fd8 x15: 0000000000000002 [ 74.020376][ T9198] x14: 0000000000000001 x13: 1fffe000341f1ed7 x12: 0000000000ff0100 [ 74.021667][ T9198] x11: 0000000000000000 x10: 0000000000000000 x9 : b9d0e8e75d457300 [ 74.022935][ T9198] x8 : b9d0e8e75d457300 x7 : 0000000000000000 x6 : ffff800008247e40 [ 74.024147][ T9198] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80000a75d4cc [ 74.025371][ T9198] x2 : ffff0001a0f83d50 x1 : 0000000100000000 x0 : 000000000000006a [ 74.026600][ T9198] Call trace: [ 74.027087][ T9198] debug_print_object+0x148/0x1d4 [ 74.027830][ T9198] debug_object_assert_init+0x24c/0x2c4 [ 74.028679][ T9198] __timer_delete+0x50/0x21c [ 74.029346][ T9198] timer_delete+0x24/0x34 [ 74.029994][ T9198] sk_stop_timer+0x24/0xcc [ 74.030619][ T9198] __mptcp_destroy_sock+0x294/0x610 [ 74.031385][ T9198] mptcp_close+0x5b8/0x9e4 [ 74.032045][ T9198] inet_release+0x120/0x16c [ 74.032668][ T9198] sock_close+0xb4/0x1f8 [ 74.033298][ T9198] __fput+0x1c0/0x7e8 [ 74.033895][ T9198] ____fput+0x20/0x30 [ 74.034488][ T9198] task_work_run+0x12c/0x1d8 [ 74.035139][ T9198] do_notify_resume+0x2450/0x309c [ 74.035928][ T9198] el0_svc+0xf0/0x1d0 [ 74.036509][ T9198] el0t_64_sync_handler+0xcc/0xe4 [ 74.037247][ T9198] el0t_64_sync+0x1a0/0x1a4 [ 74.037887][ T9198] irq event stamp: 0 [ 74.038454][ T9198] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 74.039492][ T9198] hardirqs last disabled at (0): [] copy_process+0x1110/0x34c8 [ 74.040798][ T9198] softirqs last enabled at (0): [] copy_process+0x1140/0x34c8 [ 74.042116][ T9198] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 74.043153][ T9198] ---[ end trace e2225bb19106e3ae ]---